github/kata-containers
1
0
Fork 2
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-09-20 08:18:24 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #9243 from microsoft/danmihai1/genpolicy-unblock-ci

Browse Source 
genpolicy: disable env variable verification
This commit is contained in:
Dan Mihai
2024-03-06 21:44:18 -08:00
committed by GitHub
parent 640ed591bd e61ef30a76
commit 73a8b61c2e
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/tools/genpolicy/rules.rego
View File

@@ -550,9 +550,10 @@ allow_env(p_process, i_process, s_name) {
print("allow_env: p env =", p_process.Env) print("allow_env: p env =", p_process.Env)
print("allow_env: i env =", i_process.Env) print("allow_env: i env =", i_process.Env)
every i_var in i_process.Env { # TODO: re-enable after fixing https://github.com/kata-containers/kata-containers/issues/9239.
allow_var(p_process, i_process, i_var, s_name) # every i_var in i_process.Env {
} # allow_var(p_process, i_process, i_var, s_name)
# }
print("allow_env: true") print("allow_env: true")
} }

6
src/tools/genpolicy/src/registry.rs
View File

@@ -41,7 +41,7 @@ struct DockerConfigLayer {
struct DockerImageConfig { struct DockerImageConfig {
User: Option<String>, User: Option<String>,
Tty: Option<bool>, Tty: Option<bool>,
Env: Vec<String>, Env: Option<Vec<String>>,
Cmd: Option<Vec<String>>, Cmd: Option<Vec<String>>,
WorkingDir: Option<String>, WorkingDir: Option<String>,
Entrypoint: Option<Vec<String>>, Entrypoint: Option<Vec<String>>,
@@ -159,9 +159,11 @@ impl Container {
process.Terminal = false; process.Terminal = false;
} }
for env in &docker_config.Env { if let Some(config_env) = &docker_config.Env {
for env in config_env {
process.Env.push(env.clone()); process.Env.push(env.clone());
} }
}
let policy_args = &mut process.Args; let policy_args = &mut process.Args;
debug!("Already existing policy args: {:?}", policy_args); debug!("Already existing policy args: {:?}", policy_args);